Files, folders, URLs, accounts, and permissions

Files hold information, folders organize it, URLs locate resources, accounts identify people, and permissions decide what each identity may do. Keeping these roles separate prevents many everyday security mistakes.

At a glance

Question	Practical answer
When is it useful?	A shared project folder can be readable by a team account while its billing page is restricted to an owner; the URL identifies the resource but does not grant access.
What should you do?	Create a small folder tree, share one folder with view-only access, and record which account owns each item.
How do you know it worked?	Open the shared link in a private browser window: the intended public item opens, while the restricted item asks for authentication.
Common failure	Do not assume that an unguessable link is private; access must be enforced by permissions.

flowchart LR
  A[Question] --> B[Files, folders, URLs, accounts, and permis]
  B --> C[Small example]
  C --> D[Evidence]

The important idea is not to stop at a definition: connect the concept to a small example and observable evidence.

Worked example

A shared project folder can be readable by a team account while its billing page is restricted to an owner; the URL identifies the resource but does not grant access.

Before acting, write the success signal. Change one condition at a time, observe the result, and record assumptions. For Files, folders, URLs, accounts, and permissions, this separates what you know from what you are merely guessing.

Practice in 20–30 minutes

Goal: Create a small folder tree, share one folder with view-only access, and record which account owns each item.

1. Record the starting state and your prediction.
2. Implement the smallest version without adding unnecessary tools.
3. Change exactly one input or constraint and repeat.
4. Save a command, screenshot, output, or checklist as evidence.

Expected result: Open the shared link in a private browser window: the intended public item opens, while the restricted item asks for authentication.

What can go wrong

Do not assume that an unguessable link is private; access must be enforced by permissions.

When the result differs from your prediction, do not change many things at once. Check inputs, versions, environment, permissions, and logs, then repeat from the smallest example.

Definition of done

• I can explain the concept in my own words.
• I completed the small example and kept evidence.
• I know one failure mode and how to check it.
• Someone else can repeat the work without guessing missing steps.

Go deeper

Use the linked resource or repository at the end of the page when you need a full implementation. Check current versions before applying commands to a real project.